CVE-2026-45538 OpenSIPS CVE debrief

Who should care

OpenSIPS users and administrators, particularly those using sip_to_json() in routing scripts, should be aware of this critical vulnerability and take immediate action to patch or mitigate the risk. This includes reviewing and updating routing scripts to avoid using sip_to_json() if possible, implementing compensating controls, and verifying OpenSIPS deployments for exposure. The vulnerability has a critical CVSS score of 9.8, indicating a high severity level. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated to prioritize patching and mitigation efforts effectively. Inventory checks should be conducted to identify potentially affected systems, and monitoring should be enhanced to detect potential exploitation attempts. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability affects OpenSIPS deployments using sip_to_json() in routing scripts, and its impact can be significant if not properly addressed. Therefore, it is crucial for OpenSIPS users and administrators to assess their exposure and take necessary actions to prevent exploitation. Additionally, they should consider the potential operational impact of this vulnerability on their systems and implement measures to minimize it. By taking proactive steps, OpenSIPS users and administrators can reduce the risk associated with this critical vulnerability and protect their systems from potential attacks. It is also essential to review compensating controls for exposed systems while remediation is scheduled and verified, and to check relevant monitoring, detection, and logs for exposed assets that need extra review. Overall, OpenSIPS users and administrators must prioritize patching and mitigation efforts to address this critical vulnerability effectively. The vulnerability's impact on the system can be severe if not properly addressed, making it essential to take immediate action to prevent exploitation. By doing so, OpenSIPS users and administrators can ensure the security and integrity of their systems and protect against potential attacks. To further mitigate the risk,

Technical summary

OpenSIPS versions 4.0.0 and prior contain a stack buffer overflow vulnerability in the sip_to_json() function. When a SIP message with a header name longer than 255 bytes is processed, it can cause a stack buffer overflow, potentially leading to remote code execution. This issue affects deployments whose routing script invokes sip_to_json(). The vulnerability is due to a memcpy operation that copies SIP header names into a fixed 255-byte stack buffer without bounds checking. The CVE record indicates that a single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution.

Defensive priority

OpenSIPS deployments using sip_to_json() in routing scripts should prioritize patching due to the critical CVSS score of 9.8 and potential for remote code execution.

Recommended defensive actions

• Apply patches or updates to OpenSIPS to address the stack buffer overflow vulnerability
• Review and update routing scripts to avoid using sip_to_json() if possible
• Implement compensating controls, such as monitoring and exception tracking, to detect potential exploitation attempts
• Verify OpenSIPS deployments for exposure and prioritize patching
• Conduct inventory checks to identify potentially affected systems

Evidence notes

Evidence is limited; primary official records indicate a stack buffer overflow in OpenSIPS versions 4.0.0 and prior when processing SIP messages with header names longer than 255 bytes. Verification of affected scope, inventory checks, and vendor remediation status are recommended.

Official resources